Add privilege management system with related migrations and guards
- Introduced a new `PrivilegesModule` to manage user privileges and access control. - Added `RequirePrivilege` decorator to enforce privilege checks on controller handlers. - Implemented `PrivilegesGuard` to handle authorization based on user privileges. - Created database migrations for `privileges`, `privilege_keys`, and `privilege_details` tables. - Updated user model to include `is_superadmin` field for enhanced access control. - Added unit tests for the new privileges functionality and guards to ensure correct behavior.
This commit is contained in:
shancheas
@@ -1,4 +1,6 @@
|
||||
import { Test, TestingModule } from '@nestjs/testing';
|
||||
import { PrivilegesService } from '../privileges/privileges.service';
|
||||
import { UsersService } from '../users/users.service';
|
||||
import { AuthController } from './auth.controller';
|
||||
import { AuthService } from './auth.service';
|
||||
|
||||
@@ -7,6 +9,10 @@ describe('AuthController', () => {
|
||||
let authService: jest.Mocked<
|
||||
Pick<AuthService, 'register' | 'login' | 'refresh' | 'revoke'>
|
||||
>;
|
||||
let usersService: jest.Mocked<Pick<UsersService, 'findById'>>;
|
||||
let privilegesService: jest.Mocked<
|
||||
Pick<PrivilegesService, 'findPrivilegeSummary' | 'getPermissionsMap'>
|
||||
>;
|
||||
|
||||
beforeEach(async () => {
|
||||
authService = {
|
||||
@@ -24,10 +30,26 @@ describe('AuthController', () => {
|
||||
}),
|
||||
revoke: jest.fn().mockResolvedValue(undefined),
|
||||
};
|
||||
usersService = {
|
||||
findById: jest.fn().mockResolvedValue({
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
privilegeId: null,
|
||||
isSuperadmin: false,
|
||||
}),
|
||||
};
|
||||
privilegesService = {
|
||||
findPrivilegeSummary: jest.fn(),
|
||||
getPermissionsMap: jest.fn(),
|
||||
};
|
||||
|
||||
const moduleRef: TestingModule = await Test.createTestingModule({
|
||||
controllers: [AuthController],
|
||||
providers: [{ provide: AuthService, useValue: authService }],
|
||||
providers: [
|
||||
{ provide: AuthService, useValue: authService },
|
||||
{ provide: UsersService, useValue: usersService },
|
||||
{ provide: PrivilegesService, useValue: privilegesService },
|
||||
],
|
||||
}).compile();
|
||||
|
||||
controller = moduleRef.get(AuthController);
|
||||
@@ -55,9 +77,81 @@ describe('AuthController', () => {
|
||||
expect(authService.revoke).toHaveBeenCalledWith(token);
|
||||
});
|
||||
|
||||
it('me returns id and username', () => {
|
||||
expect(
|
||||
controller.me({ id: 'user-1', username: 'alice', jti: 'jti-1' }),
|
||||
).toEqual({ id: 'user-1', username: 'alice' });
|
||||
it('me returns privilege null when unassigned', async () => {
|
||||
await expect(
|
||||
controller.me({
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
jti: 'jti-1',
|
||||
isSuperadmin: false,
|
||||
}),
|
||||
).resolves.toEqual({
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
isSuperadmin: false,
|
||||
privilege: null,
|
||||
permissions: {},
|
||||
});
|
||||
});
|
||||
|
||||
it('me returns privilege and permissions when assigned', async () => {
|
||||
usersService.findById.mockResolvedValue({
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
privilegeId: 'priv-1',
|
||||
isSuperadmin: false,
|
||||
} as never);
|
||||
privilegesService.findPrivilegeSummary.mockResolvedValue({
|
||||
id: 'priv-1',
|
||||
name: 'Admin',
|
||||
code: 'ADMIN',
|
||||
});
|
||||
privilegesService.getPermissionsMap.mockResolvedValue({
|
||||
PRIVILEGES: {
|
||||
view: true,
|
||||
create: true,
|
||||
update: true,
|
||||
delete: true,
|
||||
import: true,
|
||||
},
|
||||
});
|
||||
|
||||
await expect(
|
||||
controller.me({
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
jti: 'jti-1',
|
||||
isSuperadmin: false,
|
||||
}),
|
||||
).resolves.toMatchObject({
|
||||
privilege: { id: 'priv-1', code: 'ADMIN' },
|
||||
permissions: {
|
||||
PRIVILEGES: expect.objectContaining({ view: true }),
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it('me returns isSuperadmin when the user is promoted', async () => {
|
||||
usersService.findById.mockResolvedValue({
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
privilegeId: null,
|
||||
isSuperadmin: true,
|
||||
} as never);
|
||||
|
||||
await expect(
|
||||
controller.me({
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
jti: 'jti-1',
|
||||
isSuperadmin: true,
|
||||
}),
|
||||
).resolves.toEqual({
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
isSuperadmin: true,
|
||||
privilege: null,
|
||||
permissions: {},
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
@@ -16,6 +16,8 @@ import type { AuthUser } from '../../common/auth/auth-user';
|
||||
import { CurrentUser } from '../../common/decorators/current-user.decorator';
|
||||
import { Public } from '../../common/decorators/public.decorator';
|
||||
import { BEARER_AUTH_NAME } from '../../common/swagger/setup-swagger';
|
||||
import { PrivilegesService } from '../privileges/privileges.service';
|
||||
import { UsersService } from '../users/users.service';
|
||||
import { AuthService } from './auth.service';
|
||||
import {
|
||||
LoginDto,
|
||||
@@ -28,7 +30,11 @@ import {
|
||||
@ApiTags('auth')
|
||||
@Controller('auth')
|
||||
export class AuthController {
|
||||
constructor(private readonly authService: AuthService) {}
|
||||
constructor(
|
||||
private readonly authService: AuthService,
|
||||
private readonly usersService: UsersService,
|
||||
private readonly privilegesService: PrivilegesService,
|
||||
) {}
|
||||
|
||||
@Public()
|
||||
@Throttle({ default: { limit: 5, ttl: 60_000 } })
|
||||
@@ -87,7 +93,32 @@ export class AuthController {
|
||||
@ApiOperation({ summary: 'Get the current authenticated user' })
|
||||
@ApiOkResponse({ type: MeResponseDto })
|
||||
@ApiUnauthorizedResponse({ description: 'Missing or invalid access token' })
|
||||
me(@CurrentUser() user: AuthUser): MeResponseDto {
|
||||
return { id: user.id, username: user.username };
|
||||
async me(@CurrentUser() user: AuthUser): Promise<MeResponseDto> {
|
||||
const full = await this.usersService.findById(user.id);
|
||||
const isSuperadmin = full?.isSuperadmin ?? user.isSuperadmin;
|
||||
if (!full?.privilegeId) {
|
||||
return {
|
||||
id: user.id,
|
||||
username: user.username,
|
||||
isSuperadmin,
|
||||
privilege: null,
|
||||
permissions: {},
|
||||
};
|
||||
}
|
||||
|
||||
const privilege = await this.privilegesService.findPrivilegeSummary(
|
||||
full.privilegeId,
|
||||
);
|
||||
const permissions = privilege
|
||||
? await this.privilegesService.getPermissionsMap(privilege.id)
|
||||
: {};
|
||||
|
||||
return {
|
||||
id: user.id,
|
||||
username: user.username,
|
||||
isSuperadmin,
|
||||
privilege,
|
||||
permissions,
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -5,6 +5,8 @@ import { JwtModule } from '@nestjs/jwt';
|
||||
import { PassportModule } from '@nestjs/passport';
|
||||
import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
|
||||
import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
|
||||
import { PrivilegesGuard } from '../../common/guards/privileges.guard';
|
||||
import { PrivilegesModule } from '../privileges/privileges.module';
|
||||
import { UsersModule } from '../users/users.module';
|
||||
import { AuthController } from './auth.controller';
|
||||
import { AuthService } from './auth.service';
|
||||
@@ -15,6 +17,7 @@ import { JwtStrategy } from './strategies/jwt.strategy';
|
||||
@Module({
|
||||
imports: [
|
||||
UsersModule,
|
||||
PrivilegesModule,
|
||||
PassportModule.register({ defaultStrategy: 'jwt' }),
|
||||
JwtModule.registerAsync({
|
||||
imports: [ConfigModule],
|
||||
@@ -36,7 +39,9 @@ import { JwtStrategy } from './strategies/jwt.strategy';
|
||||
RefreshTokensRepository,
|
||||
RevokedAccessTokensRepository,
|
||||
JwtStrategy,
|
||||
// Registration order = execution order: JWT before privileges.
|
||||
{ provide: APP_GUARD, useClass: JwtAuthGuard },
|
||||
{ provide: APP_GUARD, useClass: PrivilegesGuard },
|
||||
{ provide: APP_GUARD, useClass: ThrottlerGuard },
|
||||
],
|
||||
exports: [AuthService],
|
||||
|
||||
@@ -44,6 +44,8 @@ describe('AuthService', () => {
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
passwordHash: await bcrypt.hash('password123', 4),
|
||||
privilegeId: null,
|
||||
isSuperadmin: false,
|
||||
createdAt: now,
|
||||
updatedAt: now,
|
||||
};
|
||||
|
||||
@@ -68,10 +68,50 @@ export class TokenPairDto implements TokenPair {
|
||||
refreshToken!: string;
|
||||
}
|
||||
|
||||
export class MePrivilegeDto {
|
||||
@ApiProperty({ format: 'uuid' })
|
||||
id!: string;
|
||||
|
||||
@ApiProperty()
|
||||
name!: string;
|
||||
|
||||
@ApiProperty()
|
||||
code!: string;
|
||||
}
|
||||
|
||||
export class MeResponseDto {
|
||||
@ApiProperty({ example: '550e8400-e29b-41d4-a716-446655440000' })
|
||||
id!: string;
|
||||
|
||||
@ApiProperty({ example: 'alice' })
|
||||
username!: string;
|
||||
|
||||
@ApiProperty({ example: false })
|
||||
isSuperadmin!: boolean;
|
||||
|
||||
@ApiProperty({ type: MePrivilegeDto, nullable: true })
|
||||
privilege!: MePrivilegeDto | null;
|
||||
|
||||
@ApiProperty({
|
||||
description: 'Permission matrix keyed by privilege key code',
|
||||
example: {
|
||||
PRIVILEGES: {
|
||||
view: true,
|
||||
create: false,
|
||||
update: false,
|
||||
delete: false,
|
||||
import: false,
|
||||
},
|
||||
},
|
||||
})
|
||||
permissions!: Record<
|
||||
string,
|
||||
{
|
||||
view: boolean;
|
||||
create: boolean;
|
||||
update: boolean;
|
||||
delete: boolean;
|
||||
import: boolean;
|
||||
}
|
||||
>;
|
||||
}
|
||||
|
||||
@@ -17,6 +17,8 @@ describe('JwtStrategy', () => {
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
passwordHash: 'hash',
|
||||
privilegeId: null,
|
||||
isSuperadmin: false,
|
||||
createdAt: now,
|
||||
updatedAt: now,
|
||||
};
|
||||
@@ -53,7 +55,31 @@ describe('JwtStrategy', () => {
|
||||
jti: 'jti-1',
|
||||
typ: 'access',
|
||||
}),
|
||||
).resolves.toEqual({ id: 'user-1', username: 'alice', jti: 'jti-1' });
|
||||
).resolves.toEqual({
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
jti: 'jti-1',
|
||||
isSuperadmin: false,
|
||||
});
|
||||
});
|
||||
|
||||
it('maps isSuperadmin from the persisted user', async () => {
|
||||
revoked.exists.mockResolvedValue(false);
|
||||
usersService.findById.mockResolvedValue({ ...user, isSuperadmin: true });
|
||||
|
||||
await expect(
|
||||
strategy.validate({
|
||||
sub: 'user-1',
|
||||
username: 'alice',
|
||||
jti: 'jti-1',
|
||||
typ: 'access',
|
||||
}),
|
||||
).resolves.toEqual({
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
jti: 'jti-1',
|
||||
isSuperadmin: true,
|
||||
});
|
||||
});
|
||||
|
||||
it('rejects revoked access tokens', async () => {
|
||||
|
||||
@@ -45,6 +45,7 @@ export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
|
||||
id: user.id,
|
||||
username: user.username,
|
||||
jti: payload.jti,
|
||||
isSuperadmin: user.isSuperadmin,
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,205 @@
|
||||
import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
|
||||
import { Type } from 'class-transformer';
|
||||
import {
|
||||
ArrayNotEmpty,
|
||||
IsArray,
|
||||
IsBoolean,
|
||||
IsIn,
|
||||
IsNotEmpty,
|
||||
IsOptional,
|
||||
IsString,
|
||||
IsUUID,
|
||||
MaxLength,
|
||||
ValidateNested,
|
||||
} from 'class-validator';
|
||||
import { PaginationQueryDto } from '../../../common/http/response';
|
||||
import { CORE_STATUSES } from '../../../common/value-objects/status/status';
|
||||
import { PRIVILEGE_ACTIONS } from '../privilege-action';
|
||||
|
||||
export class PrivilegeDetailInputDto {
|
||||
@ApiProperty({ format: 'uuid' })
|
||||
@IsUUID()
|
||||
privilegeKeyId!: string;
|
||||
|
||||
@ApiProperty({ enum: PRIVILEGE_ACTIONS })
|
||||
@IsIn([...PRIVILEGE_ACTIONS])
|
||||
action!: (typeof PRIVILEGE_ACTIONS)[number];
|
||||
|
||||
@ApiProperty()
|
||||
@IsBoolean()
|
||||
value!: boolean;
|
||||
}
|
||||
|
||||
export class CreatePrivilegeDto {
|
||||
@ApiProperty({ example: 'Sales Staff' })
|
||||
@IsString()
|
||||
@IsNotEmpty()
|
||||
@MaxLength(120)
|
||||
name!: string;
|
||||
|
||||
@ApiProperty({ example: 'SALES_STAFF' })
|
||||
@IsString()
|
||||
@IsNotEmpty()
|
||||
@MaxLength(64)
|
||||
code!: string;
|
||||
|
||||
@ApiPropertyOptional({ enum: CORE_STATUSES })
|
||||
@IsOptional()
|
||||
@IsIn([...CORE_STATUSES])
|
||||
status?: string;
|
||||
|
||||
@ApiPropertyOptional({ type: [PrivilegeDetailInputDto] })
|
||||
@IsOptional()
|
||||
@IsArray()
|
||||
@ValidateNested({ each: true })
|
||||
@Type(() => PrivilegeDetailInputDto)
|
||||
details?: PrivilegeDetailInputDto[];
|
||||
}
|
||||
|
||||
export class UpdatePrivilegeDto {
|
||||
@ApiPropertyOptional({ example: 'Sales Staff' })
|
||||
@IsOptional()
|
||||
@IsString()
|
||||
@IsNotEmpty()
|
||||
@MaxLength(120)
|
||||
name?: string;
|
||||
|
||||
@ApiPropertyOptional({ example: 'SALES_STAFF' })
|
||||
@IsOptional()
|
||||
@IsString()
|
||||
@IsNotEmpty()
|
||||
@MaxLength(64)
|
||||
code?: string;
|
||||
|
||||
@ApiPropertyOptional({ type: [PrivilegeDetailInputDto] })
|
||||
@IsOptional()
|
||||
@IsArray()
|
||||
@ValidateNested({ each: true })
|
||||
@Type(() => PrivilegeDetailInputDto)
|
||||
details?: PrivilegeDetailInputDto[];
|
||||
}
|
||||
|
||||
export class UpdatePrivilegeStatusDto {
|
||||
@ApiProperty({ enum: CORE_STATUSES })
|
||||
@IsIn([...CORE_STATUSES])
|
||||
status!: string;
|
||||
}
|
||||
|
||||
export class BulkIdsDto {
|
||||
@ApiProperty({ type: [String], format: 'uuid' })
|
||||
@IsArray()
|
||||
@ArrayNotEmpty()
|
||||
@IsUUID('4', { each: true })
|
||||
ids!: string[];
|
||||
}
|
||||
|
||||
export class BulkStatusDto {
|
||||
@ApiProperty({ type: [String], format: 'uuid' })
|
||||
@IsArray()
|
||||
@ArrayNotEmpty()
|
||||
@IsUUID('4', { each: true })
|
||||
ids!: string[];
|
||||
|
||||
@ApiProperty({ enum: CORE_STATUSES })
|
||||
@IsIn([...CORE_STATUSES])
|
||||
status!: string;
|
||||
}
|
||||
|
||||
export class ListPrivilegesQueryDto extends PaginationQueryDto {
|
||||
@ApiPropertyOptional()
|
||||
@IsOptional()
|
||||
@IsString()
|
||||
name?: string;
|
||||
|
||||
@ApiPropertyOptional()
|
||||
@IsOptional()
|
||||
@IsString()
|
||||
code?: string;
|
||||
|
||||
@ApiPropertyOptional({ enum: CORE_STATUSES })
|
||||
@IsOptional()
|
||||
@IsIn([...CORE_STATUSES])
|
||||
status?: string;
|
||||
|
||||
@ApiPropertyOptional({
|
||||
description: 'Case-insensitive match on name or code',
|
||||
})
|
||||
@IsOptional()
|
||||
@IsString()
|
||||
search?: string;
|
||||
}
|
||||
|
||||
export class ListPrivilegeKeysQueryDto extends PaginationQueryDto {
|
||||
@ApiPropertyOptional()
|
||||
@IsOptional()
|
||||
@IsString()
|
||||
search?: string;
|
||||
}
|
||||
|
||||
export class PrivilegeDetailDto {
|
||||
@ApiProperty({ format: 'uuid' })
|
||||
id!: string;
|
||||
|
||||
@ApiProperty({ format: 'uuid' })
|
||||
privilegeKeyId!: string;
|
||||
|
||||
@ApiProperty({ example: 'SALES.INVOICE' })
|
||||
keyCode!: string;
|
||||
|
||||
@ApiProperty({ example: 'Sales Invoice' })
|
||||
keyLabel!: string;
|
||||
|
||||
@ApiProperty({ example: 1 })
|
||||
sortOrder!: number;
|
||||
|
||||
@ApiProperty({ enum: PRIVILEGE_ACTIONS })
|
||||
action!: string;
|
||||
|
||||
@ApiProperty()
|
||||
value!: boolean;
|
||||
}
|
||||
|
||||
export class PrivilegeDto {
|
||||
@ApiProperty({ format: 'uuid' })
|
||||
id!: string;
|
||||
|
||||
@ApiProperty()
|
||||
name!: string;
|
||||
|
||||
@ApiProperty()
|
||||
code!: string;
|
||||
|
||||
@ApiProperty({ enum: CORE_STATUSES })
|
||||
status!: string;
|
||||
|
||||
@ApiProperty({ description: 'Unix ms' })
|
||||
createdAt!: number;
|
||||
|
||||
@ApiProperty({ description: 'Unix ms' })
|
||||
updatedAt!: number;
|
||||
|
||||
@ApiProperty({ format: 'uuid' })
|
||||
createdBy!: string;
|
||||
|
||||
@ApiProperty({ format: 'uuid' })
|
||||
updatedBy!: string;
|
||||
}
|
||||
|
||||
export class PrivilegeDetailResponseDto extends PrivilegeDto {
|
||||
@ApiProperty({ type: [PrivilegeDetailDto] })
|
||||
details!: PrivilegeDetailDto[];
|
||||
}
|
||||
|
||||
export class PrivilegeKeyDto {
|
||||
@ApiProperty({ format: 'uuid' })
|
||||
id!: string;
|
||||
|
||||
@ApiProperty({ example: 'PRIVILEGES' })
|
||||
code!: string;
|
||||
|
||||
@ApiProperty({ example: 'Privileges' })
|
||||
label!: string;
|
||||
|
||||
@ApiProperty({ example: 1 })
|
||||
sortOrder!: number;
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
import { assertPrivilegeAction, isPrivilegeAction } from './privilege-action';
|
||||
import {
|
||||
assertPrivilegeKeyCode,
|
||||
isValidPrivilegeKeyCode,
|
||||
} from './privilege-key-code';
|
||||
|
||||
describe('privilege-action', () => {
|
||||
it('accepts known actions', () => {
|
||||
expect(assertPrivilegeAction('view')).toBe('view');
|
||||
expect(isPrivilegeAction('import')).toBe(true);
|
||||
});
|
||||
|
||||
it('rejects unknown actions', () => {
|
||||
expect(() => assertPrivilegeAction('execute')).toThrow(TypeError);
|
||||
expect(isPrivilegeAction('execute')).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe('privilege-key-code', () => {
|
||||
it('accepts dotted uppercase module levels', () => {
|
||||
expect(isValidPrivilegeKeyCode('PRIVILEGES')).toBe(true);
|
||||
expect(isValidPrivilegeKeyCode('SALES.INVOICE')).toBe(true);
|
||||
expect(isValidPrivilegeKeyCode('SALES.INVOICE.LINE')).toBe(true);
|
||||
expect(assertPrivilegeKeyCode('USERS')).toBe('USERS');
|
||||
});
|
||||
|
||||
it('rejects invalid codes', () => {
|
||||
expect(isValidPrivilegeKeyCode('sales.invoice')).toBe(false);
|
||||
expect(isValidPrivilegeKeyCode('SALES.')).toBe(false);
|
||||
expect(isValidPrivilegeKeyCode('.SALES')).toBe(false);
|
||||
expect(isValidPrivilegeKeyCode('')).toBe(false);
|
||||
expect(() => assertPrivilegeKeyCode('bad')).toThrow(TypeError);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,23 @@
|
||||
export const PRIVILEGE_ACTIONS = [
|
||||
'view',
|
||||
'create',
|
||||
'update',
|
||||
'delete',
|
||||
'import',
|
||||
] as const;
|
||||
|
||||
export type PrivilegeAction = (typeof PRIVILEGE_ACTIONS)[number];
|
||||
|
||||
export function assertPrivilegeAction(raw: string): PrivilegeAction {
|
||||
if (
|
||||
typeof raw !== 'string' ||
|
||||
!(PRIVILEGE_ACTIONS as readonly string[]).includes(raw)
|
||||
) {
|
||||
throw new TypeError('Invalid privilege action');
|
||||
}
|
||||
return raw as PrivilegeAction;
|
||||
}
|
||||
|
||||
export function isPrivilegeAction(raw: string): raw is PrivilegeAction {
|
||||
return (PRIVILEGE_ACTIONS as readonly string[]).includes(raw);
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
/** Dotted uppercase module levels: MODULE / MODULE.RESOURCE / MODULE.RESOURCE.SUB */
|
||||
export const PRIVILEGE_KEY_CODE_PATTERN =
|
||||
/^[A-Z][A-Z0-9_]*(\.[A-Z][A-Z0-9_]*)*$/;
|
||||
|
||||
export function isValidPrivilegeKeyCode(code: string): boolean {
|
||||
return typeof code === 'string' && PRIVILEGE_KEY_CODE_PATTERN.test(code);
|
||||
}
|
||||
|
||||
export function assertPrivilegeKeyCode(code: string): string {
|
||||
if (!isValidPrivilegeKeyCode(code)) {
|
||||
throw new TypeError('Invalid privilege key code');
|
||||
}
|
||||
return code;
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
import { DateTime } from '../../common/value-objects/date-time/date-time';
|
||||
import { Status } from '../../common/value-objects/status/status';
|
||||
import type { PrivilegeAction } from './privilege-action';
|
||||
|
||||
export type PrivilegeDetail = {
|
||||
readonly id: string;
|
||||
readonly privilegeKeyId: string;
|
||||
readonly keyCode: string;
|
||||
readonly keyLabel: string;
|
||||
readonly sortOrder: number;
|
||||
readonly action: PrivilegeAction;
|
||||
readonly value: boolean;
|
||||
};
|
||||
|
||||
export type Privilege = {
|
||||
readonly id: string;
|
||||
readonly name: string;
|
||||
readonly code: string;
|
||||
readonly status: Status;
|
||||
readonly createdAt: DateTime;
|
||||
readonly updatedAt: DateTime;
|
||||
readonly createdBy: string;
|
||||
readonly updatedBy: string;
|
||||
};
|
||||
|
||||
export type PrivilegeWithDetails = Privilege & {
|
||||
readonly details: readonly PrivilegeDetail[];
|
||||
};
|
||||
|
||||
export type PrivilegeDetailInput = {
|
||||
readonly privilegeKeyId: string;
|
||||
readonly action: PrivilegeAction;
|
||||
readonly value: boolean;
|
||||
};
|
||||
|
||||
export type CreatePrivilegeInput = {
|
||||
readonly name: string;
|
||||
readonly code: string;
|
||||
readonly status?: Status;
|
||||
readonly details?: readonly PrivilegeDetailInput[];
|
||||
readonly userId: string;
|
||||
};
|
||||
|
||||
export type UpdatePrivilegeInput = {
|
||||
readonly name?: string;
|
||||
readonly code?: string;
|
||||
readonly details?: readonly PrivilegeDetailInput[];
|
||||
readonly userId: string;
|
||||
};
|
||||
|
||||
export type PrivilegeKey = {
|
||||
readonly id: string;
|
||||
readonly code: string;
|
||||
readonly label: string;
|
||||
readonly sortOrder: number;
|
||||
};
|
||||
|
||||
export type ListPrivilegesFilters = {
|
||||
readonly name?: string;
|
||||
readonly code?: string;
|
||||
readonly status?: string;
|
||||
readonly search?: string;
|
||||
readonly limit: number;
|
||||
readonly offset: number;
|
||||
};
|
||||
|
||||
export type ListPrivilegeKeysFilters = {
|
||||
readonly search?: string;
|
||||
readonly limit: number;
|
||||
readonly offset: number;
|
||||
};
|
||||
@@ -0,0 +1,53 @@
|
||||
import { Controller, Get, Query } from '@nestjs/common';
|
||||
import {
|
||||
ApiBearerAuth,
|
||||
ApiForbiddenResponse,
|
||||
ApiOkResponse,
|
||||
ApiOperation,
|
||||
ApiTags,
|
||||
ApiUnauthorizedResponse,
|
||||
} from '@nestjs/swagger';
|
||||
import { RequirePrivilege } from '../../common/decorators/require-privilege.decorator';
|
||||
import {
|
||||
Pagination,
|
||||
type PaginationResponse,
|
||||
PaginationMetaDto,
|
||||
} from '../../common/http/response';
|
||||
import { BEARER_AUTH_NAME } from '../../common/swagger/setup-swagger';
|
||||
import {
|
||||
ListPrivilegeKeysQueryDto,
|
||||
PrivilegeKeyDto,
|
||||
} from './dto/privilege.dto';
|
||||
import { PrivilegesService } from './privileges.service';
|
||||
|
||||
@ApiTags('privilege-keys')
|
||||
@ApiBearerAuth(BEARER_AUTH_NAME)
|
||||
@Controller('privilege-keys')
|
||||
export class PrivilegeKeysController {
|
||||
constructor(private readonly privilegesService: PrivilegesService) {}
|
||||
|
||||
@Get()
|
||||
@Pagination()
|
||||
@RequirePrivilege('PRIVILEGES', 'view')
|
||||
@ApiOperation({ summary: 'List privilege keys catalog' })
|
||||
@ApiOkResponse({
|
||||
schema: {
|
||||
properties: {
|
||||
data: {
|
||||
type: 'array',
|
||||
items: { $ref: '#/components/schemas/PrivilegeKeyDto' },
|
||||
},
|
||||
meta: { $ref: '#/components/schemas/PaginationMetaDto' },
|
||||
},
|
||||
},
|
||||
})
|
||||
@ApiUnauthorizedResponse()
|
||||
@ApiForbiddenResponse()
|
||||
list(
|
||||
@Query() query: ListPrivilegeKeysQueryDto,
|
||||
): Promise<PaginationResponse<PrivilegeKeyDto>> {
|
||||
return this.privilegesService.listKeys(query);
|
||||
}
|
||||
}
|
||||
|
||||
void PaginationMetaDto;
|
||||
@@ -0,0 +1,69 @@
|
||||
import { Controller, Get, Param, ParseUUIDPipe, Query } from '@nestjs/common';
|
||||
import {
|
||||
ApiBearerAuth,
|
||||
ApiForbiddenResponse,
|
||||
ApiNotFoundResponse,
|
||||
ApiOkResponse,
|
||||
ApiOperation,
|
||||
ApiTags,
|
||||
ApiUnauthorizedResponse,
|
||||
} from '@nestjs/swagger';
|
||||
import { RequirePrivilege } from '../../common/decorators/require-privilege.decorator';
|
||||
import {
|
||||
Pagination,
|
||||
type PaginationResponse,
|
||||
PaginationMetaDto,
|
||||
} from '../../common/http/response';
|
||||
import { BEARER_AUTH_NAME } from '../../common/swagger/setup-swagger';
|
||||
import {
|
||||
ListPrivilegesQueryDto,
|
||||
PrivilegeDetailResponseDto,
|
||||
PrivilegeDto,
|
||||
} from './dto/privilege.dto';
|
||||
import { PrivilegesService } from './privileges.service';
|
||||
|
||||
@ApiTags('privileges')
|
||||
@ApiBearerAuth(BEARER_AUTH_NAME)
|
||||
@Controller('privileges')
|
||||
export class PrivilegesReadController {
|
||||
constructor(private readonly privilegesService: PrivilegesService) {}
|
||||
|
||||
@Get()
|
||||
@Pagination()
|
||||
@RequirePrivilege('PRIVILEGES', 'view')
|
||||
@ApiOperation({ summary: 'List privileges' })
|
||||
@ApiOkResponse({
|
||||
schema: {
|
||||
properties: {
|
||||
data: {
|
||||
type: 'array',
|
||||
items: { $ref: '#/components/schemas/PrivilegeDto' },
|
||||
},
|
||||
meta: { $ref: '#/components/schemas/PaginationMetaDto' },
|
||||
},
|
||||
},
|
||||
})
|
||||
@ApiUnauthorizedResponse()
|
||||
@ApiForbiddenResponse()
|
||||
list(
|
||||
@Query() query: ListPrivilegesQueryDto,
|
||||
): Promise<PaginationResponse<PrivilegeDto>> {
|
||||
return this.privilegesService.list(query);
|
||||
}
|
||||
|
||||
@Get(':id')
|
||||
@RequirePrivilege('PRIVILEGES', 'view')
|
||||
@ApiOperation({ summary: 'Get privilege detail with matrix' })
|
||||
@ApiOkResponse({ type: PrivilegeDetailResponseDto })
|
||||
@ApiNotFoundResponse()
|
||||
@ApiUnauthorizedResponse()
|
||||
@ApiForbiddenResponse()
|
||||
findOne(
|
||||
@Param('id', ParseUUIDPipe) id: string,
|
||||
): Promise<PrivilegeDetailResponseDto> {
|
||||
return this.privilegesService.findById(id);
|
||||
}
|
||||
}
|
||||
|
||||
// Keep PaginationMetaDto referenced for OpenAPI plugin consumers.
|
||||
void PaginationMetaDto;
|
||||
@@ -0,0 +1,185 @@
|
||||
import {
|
||||
BadRequestException,
|
||||
Body,
|
||||
Controller,
|
||||
Delete,
|
||||
HttpCode,
|
||||
Param,
|
||||
ParseUUIDPipe,
|
||||
Patch,
|
||||
Post,
|
||||
UploadedFile,
|
||||
UseInterceptors,
|
||||
} from '@nestjs/common';
|
||||
import { FileInterceptor } from '@nestjs/platform-express';
|
||||
import {
|
||||
ApiBearerAuth,
|
||||
ApiBody,
|
||||
ApiConsumes,
|
||||
ApiCreatedResponse,
|
||||
ApiForbiddenResponse,
|
||||
ApiNoContentResponse,
|
||||
ApiNotFoundResponse,
|
||||
ApiOkResponse,
|
||||
ApiOperation,
|
||||
ApiTags,
|
||||
ApiUnauthorizedResponse,
|
||||
} from '@nestjs/swagger';
|
||||
import { CurrentUser } from '../../common/decorators/current-user.decorator';
|
||||
import { RequirePrivilege } from '../../common/decorators/require-privilege.decorator';
|
||||
import { BEARER_AUTH_NAME } from '../../common/swagger/setup-swagger';
|
||||
import {
|
||||
BulkIdsDto,
|
||||
BulkStatusDto,
|
||||
CreatePrivilegeDto,
|
||||
PrivilegeDetailResponseDto,
|
||||
PrivilegeDto,
|
||||
UpdatePrivilegeDto,
|
||||
UpdatePrivilegeStatusDto,
|
||||
} from './dto/privilege.dto';
|
||||
import { PrivilegesService } from './privileges.service';
|
||||
|
||||
@ApiTags('privileges')
|
||||
@ApiBearerAuth(BEARER_AUTH_NAME)
|
||||
@Controller('privileges')
|
||||
export class PrivilegesWriteController {
|
||||
constructor(private readonly privilegesService: PrivilegesService) {}
|
||||
|
||||
@Post('import')
|
||||
@RequirePrivilege('PRIVILEGES', 'import')
|
||||
@UseInterceptors(
|
||||
FileInterceptor('file', {
|
||||
limits: { fileSize: 1_048_576 },
|
||||
fileFilter: (_req, file, cb) => {
|
||||
if (
|
||||
!file.mimetype.includes('csv') &&
|
||||
!file.originalname.toLowerCase().endsWith('.csv')
|
||||
) {
|
||||
cb(new BadRequestException('Only CSV files are allowed'), false);
|
||||
return;
|
||||
}
|
||||
cb(null, true);
|
||||
},
|
||||
}),
|
||||
)
|
||||
@ApiConsumes('multipart/form-data')
|
||||
@ApiBody({
|
||||
schema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
file: { type: 'string', format: 'binary' },
|
||||
},
|
||||
required: ['file'],
|
||||
},
|
||||
})
|
||||
@ApiOperation({ summary: 'Import privileges from CSV' })
|
||||
@ApiOkResponse({
|
||||
schema: {
|
||||
properties: { imported: { type: 'number' } },
|
||||
},
|
||||
})
|
||||
@ApiUnauthorizedResponse()
|
||||
@ApiForbiddenResponse()
|
||||
importCsv(
|
||||
@UploadedFile() file: { buffer?: Buffer } | undefined,
|
||||
@CurrentUser('id') userId: string,
|
||||
): Promise<{ imported: number }> {
|
||||
const csv = file?.buffer?.toString('utf8') ?? '';
|
||||
return this.privilegesService.importCsv(csv, userId);
|
||||
}
|
||||
|
||||
@Post('bulk-delete')
|
||||
@HttpCode(200)
|
||||
@RequirePrivilege('PRIVILEGES', 'delete')
|
||||
@ApiOperation({ summary: 'Bulk delete privileges' })
|
||||
@ApiOkResponse({
|
||||
schema: { properties: { deleted: { type: 'number' } } },
|
||||
})
|
||||
@ApiUnauthorizedResponse()
|
||||
@ApiForbiddenResponse()
|
||||
bulkDelete(@Body() dto: BulkIdsDto): Promise<{ deleted: number }> {
|
||||
return this.privilegesService.bulkDelete(dto.ids);
|
||||
}
|
||||
|
||||
@Post('bulk-status')
|
||||
@HttpCode(200)
|
||||
@RequirePrivilege('PRIVILEGES', 'update')
|
||||
@ApiOperation({ summary: 'Bulk update privilege status' })
|
||||
@ApiOkResponse({
|
||||
schema: { properties: { updated: { type: 'number' } } },
|
||||
})
|
||||
@ApiUnauthorizedResponse()
|
||||
@ApiForbiddenResponse()
|
||||
bulkStatus(
|
||||
@Body() dto: BulkStatusDto,
|
||||
@CurrentUser('id') userId: string,
|
||||
): Promise<{ updated: number }> {
|
||||
return this.privilegesService.bulkUpdateStatus(dto.ids, dto.status, userId);
|
||||
}
|
||||
|
||||
@Post()
|
||||
@RequirePrivilege('PRIVILEGES', 'create')
|
||||
@ApiOperation({ summary: 'Create privilege' })
|
||||
@ApiCreatedResponse({ type: PrivilegeDetailResponseDto })
|
||||
@ApiUnauthorizedResponse()
|
||||
@ApiForbiddenResponse()
|
||||
create(
|
||||
@Body() dto: CreatePrivilegeDto,
|
||||
@CurrentUser('id') userId: string,
|
||||
): Promise<PrivilegeDetailResponseDto> {
|
||||
return this.privilegesService.create({
|
||||
name: dto.name,
|
||||
code: dto.code,
|
||||
status: dto.status,
|
||||
details: dto.details,
|
||||
userId,
|
||||
});
|
||||
}
|
||||
|
||||
@Patch(':id/status')
|
||||
@RequirePrivilege('PRIVILEGES', 'update')
|
||||
@ApiOperation({ summary: 'Update privilege status' })
|
||||
@ApiOkResponse({ type: PrivilegeDto })
|
||||
@ApiNotFoundResponse()
|
||||
@ApiUnauthorizedResponse()
|
||||
@ApiForbiddenResponse()
|
||||
updateStatus(
|
||||
@Param('id', ParseUUIDPipe) id: string,
|
||||
@Body() dto: UpdatePrivilegeStatusDto,
|
||||
@CurrentUser('id') userId: string,
|
||||
): Promise<PrivilegeDto> {
|
||||
return this.privilegesService.updateStatus(id, dto.status, userId);
|
||||
}
|
||||
|
||||
@Patch(':id')
|
||||
@RequirePrivilege('PRIVILEGES', 'update')
|
||||
@ApiOperation({ summary: 'Update privilege (not status)' })
|
||||
@ApiOkResponse({ type: PrivilegeDetailResponseDto })
|
||||
@ApiNotFoundResponse()
|
||||
@ApiUnauthorizedResponse()
|
||||
@ApiForbiddenResponse()
|
||||
update(
|
||||
@Param('id', ParseUUIDPipe) id: string,
|
||||
@Body() dto: UpdatePrivilegeDto,
|
||||
@CurrentUser('id') userId: string,
|
||||
): Promise<PrivilegeDetailResponseDto> {
|
||||
return this.privilegesService.update(id, {
|
||||
name: dto.name,
|
||||
code: dto.code,
|
||||
details: dto.details,
|
||||
userId,
|
||||
});
|
||||
}
|
||||
|
||||
@Delete(':id')
|
||||
@HttpCode(204)
|
||||
@RequirePrivilege('PRIVILEGES', 'delete')
|
||||
@ApiOperation({ summary: 'Delete privilege' })
|
||||
@ApiNoContentResponse()
|
||||
@ApiNotFoundResponse()
|
||||
@ApiUnauthorizedResponse()
|
||||
@ApiForbiddenResponse()
|
||||
async delete(@Param('id', ParseUUIDPipe) id: string): Promise<void> {
|
||||
await this.privilegesService.delete(id);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
import { Module } from '@nestjs/common';
|
||||
import { PrivilegeKeysController } from './privileges-keys.controller';
|
||||
import { PrivilegesReadController } from './privileges-read.controller';
|
||||
import { PrivilegesWriteController } from './privileges-write.controller';
|
||||
import { PrivilegesRepository } from './privileges.repository';
|
||||
import { PrivilegesService } from './privileges.service';
|
||||
|
||||
@Module({
|
||||
controllers: [
|
||||
PrivilegesReadController,
|
||||
PrivilegesWriteController,
|
||||
PrivilegeKeysController,
|
||||
],
|
||||
providers: [PrivilegesRepository, PrivilegesService],
|
||||
exports: [PrivilegesService],
|
||||
})
|
||||
export class PrivilegesModule {}
|
||||
@@ -0,0 +1,488 @@
|
||||
import {
|
||||
ConflictException,
|
||||
Inject,
|
||||
Injectable,
|
||||
NotFoundException,
|
||||
} from '@nestjs/common';
|
||||
import { and, asc, count, eq, ilike, inArray, or, SQL } from 'drizzle-orm';
|
||||
import { DateTime } from '../../common/value-objects/date-time/date-time';
|
||||
import { Status } from '../../common/value-objects/status/status';
|
||||
import { DRIZZLE, type DrizzleDB } from '../../database/database.module';
|
||||
import {
|
||||
privilegeDetails,
|
||||
privilegeKeys,
|
||||
privileges,
|
||||
users,
|
||||
type PrivilegeKeyRow,
|
||||
type PrivilegeRow,
|
||||
} from '../../database/schema';
|
||||
import type { PrivilegeAction } from './privilege-action';
|
||||
import { assertPrivilegeAction } from './privilege-action';
|
||||
import type {
|
||||
CreatePrivilegeInput,
|
||||
ListPrivilegeKeysFilters,
|
||||
ListPrivilegesFilters,
|
||||
Privilege,
|
||||
PrivilegeDetail,
|
||||
PrivilegeDetailInput,
|
||||
PrivilegeKey,
|
||||
PrivilegeWithDetails,
|
||||
UpdatePrivilegeInput,
|
||||
} from './privilege';
|
||||
|
||||
@Injectable()
|
||||
export class PrivilegesRepository {
|
||||
constructor(@Inject(DRIZZLE) private readonly db: DrizzleDB) {}
|
||||
|
||||
async list(
|
||||
filters: ListPrivilegesFilters,
|
||||
): Promise<{ data: Privilege[]; total: number }> {
|
||||
const where = this.buildListWhere(filters);
|
||||
const [totalRow] = await this.db
|
||||
.select({ total: count() })
|
||||
.from(privileges)
|
||||
.where(where);
|
||||
|
||||
let qb = this.db.select().from(privileges).$dynamic();
|
||||
qb = this.extendListQuery(qb, filters);
|
||||
const rows = await qb
|
||||
.where(where)
|
||||
.orderBy(asc(privileges.code))
|
||||
.limit(filters.limit)
|
||||
.offset(filters.offset);
|
||||
|
||||
return {
|
||||
data: rows.map((row) => this.toDomain(row)),
|
||||
total: Number(totalRow?.total ?? 0),
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Hook for modules to add joins/extra predicates without forking list.
|
||||
*/
|
||||
extendListQuery<T>(qb: T, filters: ListPrivilegesFilters): T {
|
||||
void filters;
|
||||
return qb;
|
||||
}
|
||||
|
||||
async findById(id: string): Promise<PrivilegeWithDetails | null> {
|
||||
const [row] = await this.db
|
||||
.select()
|
||||
.from(privileges)
|
||||
.where(eq(privileges.id, id))
|
||||
.limit(1);
|
||||
if (!row) {
|
||||
return null;
|
||||
}
|
||||
const details = await this.loadDetails(id);
|
||||
return { ...this.toDomain(row), details };
|
||||
}
|
||||
|
||||
async findByCode(code: string): Promise<Privilege | null> {
|
||||
const [row] = await this.db
|
||||
.select()
|
||||
.from(privileges)
|
||||
.where(eq(privileges.code, code))
|
||||
.limit(1);
|
||||
return row ? this.toDomain(row) : null;
|
||||
}
|
||||
|
||||
async create(input: CreatePrivilegeInput): Promise<PrivilegeWithDetails> {
|
||||
const now = DateTime.fromUnixMs(Date.now());
|
||||
const status = input.status ?? Status.create(Status.DEFAULT);
|
||||
try {
|
||||
return await this.db.transaction(async (tx) => {
|
||||
const [row] = await tx
|
||||
.insert(privileges)
|
||||
.values({
|
||||
name: input.name,
|
||||
code: input.code,
|
||||
status: status.value,
|
||||
createdAt: now.value,
|
||||
updatedAt: now.value,
|
||||
createdBy: input.userId,
|
||||
updatedBy: input.userId,
|
||||
})
|
||||
.returning();
|
||||
|
||||
if (input.details?.length) {
|
||||
await tx.insert(privilegeDetails).values(
|
||||
input.details.map((d) => ({
|
||||
privilegeId: row.id,
|
||||
privilegeKeyId: d.privilegeKeyId,
|
||||
action: d.action,
|
||||
value: d.value,
|
||||
})),
|
||||
);
|
||||
}
|
||||
|
||||
const details = await this.loadDetails(row.id, tx);
|
||||
return { ...this.toDomain(row), details };
|
||||
});
|
||||
} catch (error) {
|
||||
this.rethrowUniqueViolation(error);
|
||||
}
|
||||
}
|
||||
|
||||
async createMany(inputs: CreatePrivilegeInput[]): Promise<number> {
|
||||
if (inputs.length === 0) {
|
||||
return 0;
|
||||
}
|
||||
const now = DateTime.fromUnixMs(Date.now());
|
||||
try {
|
||||
await this.db.transaction(async (tx) => {
|
||||
for (const input of inputs) {
|
||||
const status = input.status ?? Status.create(Status.DEFAULT);
|
||||
await tx.insert(privileges).values({
|
||||
name: input.name,
|
||||
code: input.code,
|
||||
status: status.value,
|
||||
createdAt: now.value,
|
||||
updatedAt: now.value,
|
||||
createdBy: input.userId,
|
||||
updatedBy: input.userId,
|
||||
});
|
||||
}
|
||||
});
|
||||
return inputs.length;
|
||||
} catch (error) {
|
||||
this.rethrowUniqueViolation(error);
|
||||
}
|
||||
}
|
||||
|
||||
async update(
|
||||
id: string,
|
||||
input: UpdatePrivilegeInput,
|
||||
): Promise<PrivilegeWithDetails> {
|
||||
const existing = await this.findById(id);
|
||||
if (!existing) {
|
||||
throw new NotFoundException('Privilege not found');
|
||||
}
|
||||
|
||||
const now = DateTime.fromUnixMs(Date.now());
|
||||
try {
|
||||
return await this.db.transaction(async (tx) => {
|
||||
const [row] = await tx
|
||||
.update(privileges)
|
||||
.set({
|
||||
name: input.name ?? existing.name,
|
||||
code: input.code ?? existing.code,
|
||||
updatedAt: now.value,
|
||||
updatedBy: input.userId,
|
||||
})
|
||||
.where(eq(privileges.id, id))
|
||||
.returning();
|
||||
|
||||
if (input.details !== undefined) {
|
||||
await tx
|
||||
.delete(privilegeDetails)
|
||||
.where(eq(privilegeDetails.privilegeId, id));
|
||||
if (input.details.length > 0) {
|
||||
await tx.insert(privilegeDetails).values(
|
||||
input.details.map((d) => ({
|
||||
privilegeId: id,
|
||||
privilegeKeyId: d.privilegeKeyId,
|
||||
action: d.action,
|
||||
value: d.value,
|
||||
})),
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
const details = await this.loadDetails(id, tx);
|
||||
return { ...this.toDomain(row), details };
|
||||
});
|
||||
} catch (error) {
|
||||
this.rethrowUniqueViolation(error);
|
||||
}
|
||||
}
|
||||
|
||||
async updateStatus(
|
||||
id: string,
|
||||
status: Status,
|
||||
userId: string,
|
||||
): Promise<Privilege> {
|
||||
const now = DateTime.fromUnixMs(Date.now());
|
||||
const [row] = await this.db
|
||||
.update(privileges)
|
||||
.set({
|
||||
status: status.value,
|
||||
updatedAt: now.value,
|
||||
updatedBy: userId,
|
||||
})
|
||||
.where(eq(privileges.id, id))
|
||||
.returning();
|
||||
if (!row) {
|
||||
throw new NotFoundException('Privilege not found');
|
||||
}
|
||||
return this.toDomain(row);
|
||||
}
|
||||
|
||||
async bulkUpdateStatus(
|
||||
ids: string[],
|
||||
status: Status,
|
||||
userId: string,
|
||||
): Promise<number> {
|
||||
if (ids.length === 0) {
|
||||
return 0;
|
||||
}
|
||||
const now = DateTime.fromUnixMs(Date.now());
|
||||
const rows = await this.db
|
||||
.update(privileges)
|
||||
.set({
|
||||
status: status.value,
|
||||
updatedAt: now.value,
|
||||
updatedBy: userId,
|
||||
})
|
||||
.where(inArray(privileges.id, ids))
|
||||
.returning({ id: privileges.id });
|
||||
return rows.length;
|
||||
}
|
||||
|
||||
async delete(id: string): Promise<void> {
|
||||
const assigned = await this.countUsersWithPrivilege(id);
|
||||
if (assigned > 0) {
|
||||
throw new ConflictException('Privilege is assigned to users');
|
||||
}
|
||||
const deleted = await this.db
|
||||
.delete(privileges)
|
||||
.where(eq(privileges.id, id))
|
||||
.returning({ id: privileges.id });
|
||||
if (deleted.length === 0) {
|
||||
throw new NotFoundException('Privilege not found');
|
||||
}
|
||||
}
|
||||
|
||||
async bulkDelete(ids: string[]): Promise<number> {
|
||||
if (ids.length === 0) {
|
||||
return 0;
|
||||
}
|
||||
for (const id of ids) {
|
||||
const assigned = await this.countUsersWithPrivilege(id);
|
||||
if (assigned > 0) {
|
||||
throw new ConflictException('Privilege is assigned to users');
|
||||
}
|
||||
}
|
||||
const deleted = await this.db
|
||||
.delete(privileges)
|
||||
.where(inArray(privileges.id, ids))
|
||||
.returning({ id: privileges.id });
|
||||
return deleted.length;
|
||||
}
|
||||
|
||||
async countUsersWithPrivilege(privilegeId: string): Promise<number> {
|
||||
const [row] = await this.db
|
||||
.select({ total: count() })
|
||||
.from(users)
|
||||
.where(eq(users.privilegeId, privilegeId));
|
||||
return Number(row?.total ?? 0);
|
||||
}
|
||||
|
||||
async listKeys(
|
||||
filters: ListPrivilegeKeysFilters,
|
||||
): Promise<{ data: PrivilegeKey[]; total: number }> {
|
||||
const where = filters.search
|
||||
? or(
|
||||
ilike(privilegeKeys.code, `%${filters.search}%`),
|
||||
ilike(privilegeKeys.label, `%${filters.search}%`),
|
||||
)
|
||||
: undefined;
|
||||
|
||||
const [totalRow] = await this.db
|
||||
.select({ total: count() })
|
||||
.from(privilegeKeys)
|
||||
.where(where);
|
||||
|
||||
const rows = await this.db
|
||||
.select()
|
||||
.from(privilegeKeys)
|
||||
.where(where)
|
||||
.orderBy(asc(privilegeKeys.sortOrder), asc(privilegeKeys.code))
|
||||
.limit(filters.limit)
|
||||
.offset(filters.offset);
|
||||
|
||||
return {
|
||||
data: rows.map((row) => this.toKeyDomain(row)),
|
||||
total: Number(totalRow?.total ?? 0),
|
||||
};
|
||||
}
|
||||
|
||||
async findKeyById(id: string): Promise<PrivilegeKey | null> {
|
||||
const [row] = await this.db
|
||||
.select()
|
||||
.from(privilegeKeys)
|
||||
.where(eq(privilegeKeys.id, id))
|
||||
.limit(1);
|
||||
return row ? this.toKeyDomain(row) : null;
|
||||
}
|
||||
|
||||
async findKeyByCode(code: string): Promise<PrivilegeKey | null> {
|
||||
const [row] = await this.db
|
||||
.select()
|
||||
.from(privilegeKeys)
|
||||
.where(eq(privilegeKeys.code, code))
|
||||
.limit(1);
|
||||
return row ? this.toKeyDomain(row) : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns true only when the user's assigned privilege has value=true
|
||||
* for the given key code and action.
|
||||
*/
|
||||
async checkPermission(
|
||||
userId: string,
|
||||
keyCode: string,
|
||||
action: PrivilegeAction,
|
||||
): Promise<boolean> {
|
||||
const [row] = await this.db
|
||||
.select({ value: privilegeDetails.value })
|
||||
.from(users)
|
||||
.innerJoin(privileges, eq(users.privilegeId, privileges.id))
|
||||
.innerJoin(
|
||||
privilegeDetails,
|
||||
eq(privilegeDetails.privilegeId, privileges.id),
|
||||
)
|
||||
.innerJoin(
|
||||
privilegeKeys,
|
||||
eq(privilegeDetails.privilegeKeyId, privilegeKeys.id),
|
||||
)
|
||||
.where(
|
||||
and(
|
||||
eq(users.id, userId),
|
||||
eq(privileges.status, 'active'),
|
||||
eq(privilegeKeys.code, keyCode),
|
||||
eq(privilegeDetails.action, action),
|
||||
eq(privilegeDetails.value, true),
|
||||
),
|
||||
)
|
||||
.limit(1);
|
||||
return row?.value === true;
|
||||
}
|
||||
|
||||
async getPermissionsMap(
|
||||
privilegeId: string,
|
||||
): Promise<Record<string, Record<PrivilegeAction, boolean>>> {
|
||||
const rows = await this.db
|
||||
.select({
|
||||
code: privilegeKeys.code,
|
||||
action: privilegeDetails.action,
|
||||
value: privilegeDetails.value,
|
||||
})
|
||||
.from(privilegeDetails)
|
||||
.innerJoin(
|
||||
privilegeKeys,
|
||||
eq(privilegeDetails.privilegeKeyId, privilegeKeys.id),
|
||||
)
|
||||
.where(eq(privilegeDetails.privilegeId, privilegeId));
|
||||
|
||||
const map: Record<string, Record<string, boolean>> = {};
|
||||
for (const row of rows) {
|
||||
const action = assertPrivilegeAction(row.action);
|
||||
const current = map[row.code] ?? {
|
||||
view: false,
|
||||
create: false,
|
||||
update: false,
|
||||
delete: false,
|
||||
import: false,
|
||||
};
|
||||
map[row.code] = { ...current, [action]: row.value };
|
||||
}
|
||||
return map;
|
||||
}
|
||||
|
||||
private buildListWhere(filters: ListPrivilegesFilters): SQL | undefined {
|
||||
const parts: SQL[] = [];
|
||||
if (filters.name) {
|
||||
parts.push(ilike(privileges.name, `%${filters.name}%`));
|
||||
}
|
||||
if (filters.code) {
|
||||
parts.push(ilike(privileges.code, `%${filters.code}%`));
|
||||
}
|
||||
if (filters.status) {
|
||||
parts.push(eq(privileges.status, filters.status));
|
||||
}
|
||||
if (filters.search) {
|
||||
const search = or(
|
||||
ilike(privileges.name, `%${filters.search}%`),
|
||||
ilike(privileges.code, `%${filters.search}%`),
|
||||
);
|
||||
if (search) {
|
||||
parts.push(search);
|
||||
}
|
||||
}
|
||||
if (parts.length === 0) {
|
||||
return undefined;
|
||||
}
|
||||
return parts.length === 1 ? parts[0] : and(...parts);
|
||||
}
|
||||
|
||||
private async loadDetails(
|
||||
privilegeId: string,
|
||||
tx:
|
||||
DrizzleDB | Parameters<Parameters<DrizzleDB['transaction']>[0]>[0] = this
|
||||
.db,
|
||||
): Promise<PrivilegeDetail[]> {
|
||||
const rows = await tx
|
||||
.select({
|
||||
id: privilegeDetails.id,
|
||||
privilegeKeyId: privilegeDetails.privilegeKeyId,
|
||||
keyCode: privilegeKeys.code,
|
||||
keyLabel: privilegeKeys.label,
|
||||
sortOrder: privilegeKeys.sortOrder,
|
||||
action: privilegeDetails.action,
|
||||
value: privilegeDetails.value,
|
||||
})
|
||||
.from(privilegeDetails)
|
||||
.innerJoin(
|
||||
privilegeKeys,
|
||||
eq(privilegeDetails.privilegeKeyId, privilegeKeys.id),
|
||||
)
|
||||
.where(eq(privilegeDetails.privilegeId, privilegeId))
|
||||
.orderBy(asc(privilegeKeys.sortOrder), asc(privilegeDetails.action));
|
||||
|
||||
return rows.map((row) => ({
|
||||
id: row.id,
|
||||
privilegeKeyId: row.privilegeKeyId,
|
||||
keyCode: row.keyCode,
|
||||
keyLabel: row.keyLabel,
|
||||
sortOrder: row.sortOrder,
|
||||
action: assertPrivilegeAction(row.action),
|
||||
value: row.value,
|
||||
}));
|
||||
}
|
||||
|
||||
private toDomain(row: PrivilegeRow): Privilege {
|
||||
return {
|
||||
id: row.id,
|
||||
name: row.name,
|
||||
code: row.code,
|
||||
status: Status.create(row.status),
|
||||
createdAt: DateTime.fromUnixMs(row.createdAt),
|
||||
updatedAt: DateTime.fromUnixMs(row.updatedAt),
|
||||
createdBy: row.createdBy,
|
||||
updatedBy: row.updatedBy,
|
||||
};
|
||||
}
|
||||
|
||||
private toKeyDomain(row: PrivilegeKeyRow): PrivilegeKey {
|
||||
return {
|
||||
id: row.id,
|
||||
code: row.code,
|
||||
label: row.label,
|
||||
sortOrder: row.sortOrder,
|
||||
};
|
||||
}
|
||||
|
||||
private rethrowUniqueViolation(error: unknown): never {
|
||||
const err = error as { code?: string; constraint?: string };
|
||||
if (err.code === '23505') {
|
||||
if (err.constraint?.includes('privilege_details')) {
|
||||
throw new ConflictException('Duplicate privilege detail');
|
||||
}
|
||||
throw new ConflictException('Privilege code already exists');
|
||||
}
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
export type { PrivilegeDetailInput };
|
||||
@@ -0,0 +1,144 @@
|
||||
import { BadRequestException, NotFoundException } from '@nestjs/common';
|
||||
import { Test, TestingModule } from '@nestjs/testing';
|
||||
import { DateTime } from '../../common/value-objects/date-time/date-time';
|
||||
import { Status } from '../../common/value-objects/status/status';
|
||||
import type { PrivilegeWithDetails } from './privilege';
|
||||
import { PrivilegesRepository } from './privileges.repository';
|
||||
import { PrivilegesService } from './privileges.service';
|
||||
|
||||
describe('PrivilegesService', () => {
|
||||
let service: PrivilegesService;
|
||||
let repository: jest.Mocked<
|
||||
Pick<
|
||||
PrivilegesRepository,
|
||||
| 'list'
|
||||
| 'findById'
|
||||
| 'create'
|
||||
| 'createMany'
|
||||
| 'update'
|
||||
| 'updateStatus'
|
||||
| 'bulkUpdateStatus'
|
||||
| 'delete'
|
||||
| 'bulkDelete'
|
||||
| 'listKeys'
|
||||
| 'findKeyById'
|
||||
| 'checkPermission'
|
||||
| 'getPermissionsMap'
|
||||
>
|
||||
>;
|
||||
|
||||
const now = DateTime.fromUnixMs(1_700_000_000_000);
|
||||
const sample: PrivilegeWithDetails = {
|
||||
id: 'priv-1',
|
||||
name: 'Admin',
|
||||
code: 'ADMIN',
|
||||
status: Status.create('draft'),
|
||||
createdAt: now,
|
||||
updatedAt: now,
|
||||
createdBy: 'user-1',
|
||||
updatedBy: 'user-1',
|
||||
details: [],
|
||||
};
|
||||
|
||||
beforeEach(async () => {
|
||||
repository = {
|
||||
list: jest.fn(),
|
||||
findById: jest.fn(),
|
||||
create: jest.fn(),
|
||||
createMany: jest.fn(),
|
||||
update: jest.fn(),
|
||||
updateStatus: jest.fn(),
|
||||
bulkUpdateStatus: jest.fn(),
|
||||
delete: jest.fn(),
|
||||
bulkDelete: jest.fn(),
|
||||
listKeys: jest.fn(),
|
||||
findKeyById: jest.fn(),
|
||||
checkPermission: jest.fn(),
|
||||
getPermissionsMap: jest.fn(),
|
||||
};
|
||||
|
||||
const moduleRef: TestingModule = await Test.createTestingModule({
|
||||
providers: [
|
||||
PrivilegesService,
|
||||
{ provide: PrivilegesRepository, useValue: repository },
|
||||
],
|
||||
}).compile();
|
||||
|
||||
service = moduleRef.get(PrivilegesService);
|
||||
});
|
||||
|
||||
it('list maps visible fields and pagination', async () => {
|
||||
repository.list.mockResolvedValue({ data: [sample], total: 1 });
|
||||
const result = await service.list({ page: 1, limit: 10 });
|
||||
expect(result.total).toBe(1);
|
||||
expect(result.data[0]).toMatchObject({
|
||||
id: 'priv-1',
|
||||
status: 'draft',
|
||||
createdAt: now.value,
|
||||
});
|
||||
expect(service.visibleFields).toContain('status');
|
||||
});
|
||||
|
||||
it('findById throws when missing', async () => {
|
||||
repository.findById.mockResolvedValue(null);
|
||||
await expect(service.findById('missing')).rejects.toBeInstanceOf(
|
||||
NotFoundException,
|
||||
);
|
||||
});
|
||||
|
||||
it('create defaults status to draft', async () => {
|
||||
repository.create.mockResolvedValue(sample);
|
||||
await service.create({
|
||||
name: 'Admin',
|
||||
code: 'ADMIN',
|
||||
userId: 'user-1',
|
||||
});
|
||||
expect(repository.create).toHaveBeenCalled();
|
||||
const arg = repository.create.mock.calls[0][0];
|
||||
expect(arg.status?.value).toBe('draft');
|
||||
expect(arg.details).toBeUndefined();
|
||||
});
|
||||
|
||||
it('update rejects status field', async () => {
|
||||
await expect(
|
||||
service.update('priv-1', {
|
||||
status: 'active',
|
||||
userId: 'user-1',
|
||||
}),
|
||||
).rejects.toBeInstanceOf(BadRequestException);
|
||||
});
|
||||
|
||||
it('updateStatus updates via repository', async () => {
|
||||
repository.updateStatus.mockResolvedValue(sample);
|
||||
await service.updateStatus('priv-1', 'active', 'user-1');
|
||||
expect(repository.updateStatus).toHaveBeenCalledWith(
|
||||
'priv-1',
|
||||
expect.objectContaining({ value: 'active' }),
|
||||
'user-1',
|
||||
);
|
||||
});
|
||||
|
||||
it('importCsv creates rows and fails batch on invalid status', async () => {
|
||||
await expect(
|
||||
service.importCsv('name,code,status\nA,A1,nope', 'user-1'),
|
||||
).rejects.toBeInstanceOf(BadRequestException);
|
||||
expect(repository.createMany).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('importCsv imports valid rows', async () => {
|
||||
repository.createMany.mockResolvedValue(1);
|
||||
const result = await service.importCsv(
|
||||
'name,code,status\nAdmin,ADMIN,draft',
|
||||
'user-1',
|
||||
);
|
||||
expect(result.imported).toBe(1);
|
||||
expect(repository.createMany).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it('checkPermission delegates', async () => {
|
||||
repository.checkPermission.mockResolvedValue(true);
|
||||
await expect(
|
||||
service.checkPermission('user-1', 'PRIVILEGES', 'view'),
|
||||
).resolves.toBe(true);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,340 @@
|
||||
import {
|
||||
BadRequestException,
|
||||
Injectable,
|
||||
NotFoundException,
|
||||
} from '@nestjs/common';
|
||||
import type { PaginationResponse } from '../../common/http/response';
|
||||
import { toListPage } from '../../common/http/response';
|
||||
import { Status } from '../../common/value-objects/status/status';
|
||||
import type { PrivilegeAction } from './privilege-action';
|
||||
import { assertPrivilegeAction } from './privilege-action';
|
||||
import type {
|
||||
CreatePrivilegeInput,
|
||||
Privilege,
|
||||
PrivilegeDetailInput,
|
||||
PrivilegeKey,
|
||||
PrivilegeWithDetails,
|
||||
UpdatePrivilegeInput,
|
||||
} from './privilege';
|
||||
import { PrivilegesRepository } from './privileges.repository';
|
||||
|
||||
export type ListPrivilegesQuery = {
|
||||
readonly name?: string;
|
||||
readonly code?: string;
|
||||
readonly status?: string;
|
||||
readonly search?: string;
|
||||
readonly page?: number;
|
||||
readonly limit?: number;
|
||||
readonly offset?: number;
|
||||
};
|
||||
|
||||
export type ListPrivilegeKeysQuery = {
|
||||
readonly search?: string;
|
||||
readonly page?: number;
|
||||
readonly limit?: number;
|
||||
readonly offset?: number;
|
||||
};
|
||||
|
||||
const VISIBLE_FIELDS = [
|
||||
'id',
|
||||
'name',
|
||||
'code',
|
||||
'status',
|
||||
'createdAt',
|
||||
'updatedAt',
|
||||
'createdBy',
|
||||
'updatedBy',
|
||||
] as const;
|
||||
|
||||
@Injectable()
|
||||
export class PrivilegesService {
|
||||
constructor(private readonly privilegesRepository: PrivilegesRepository) {}
|
||||
|
||||
async list(
|
||||
query: ListPrivilegesQuery,
|
||||
): Promise<PaginationResponse<ReturnType<PrivilegesService['toListItem']>>> {
|
||||
const page = toListPage(query);
|
||||
const { data, total } = await this.privilegesRepository.list({
|
||||
name: query.name,
|
||||
code: query.code,
|
||||
status: query.status,
|
||||
search: query.search,
|
||||
limit: page.limit,
|
||||
offset: page.offset,
|
||||
});
|
||||
return {
|
||||
data: data.map((item) => this.toListItem(item)),
|
||||
total,
|
||||
};
|
||||
}
|
||||
|
||||
async findById(
|
||||
id: string,
|
||||
): Promise<ReturnType<PrivilegesService['toDetail']>> {
|
||||
const privilege = await this.privilegesRepository.findById(id);
|
||||
if (!privilege) {
|
||||
throw new NotFoundException('Privilege not found');
|
||||
}
|
||||
return this.toDetail(privilege);
|
||||
}
|
||||
|
||||
async create(
|
||||
input: Omit<CreatePrivilegeInput, 'status' | 'details'> & {
|
||||
status?: string;
|
||||
details?: readonly {
|
||||
privilegeKeyId: string;
|
||||
action: string;
|
||||
value: boolean;
|
||||
}[];
|
||||
},
|
||||
): Promise<ReturnType<PrivilegesService['toDetail']>> {
|
||||
const details = await this.normalizeDetails(input.details);
|
||||
const created = await this.privilegesRepository.create({
|
||||
name: input.name.trim(),
|
||||
code: input.code.trim(),
|
||||
status: input.status
|
||||
? Status.create(input.status)
|
||||
: Status.create(Status.DEFAULT),
|
||||
details,
|
||||
userId: input.userId,
|
||||
});
|
||||
return this.toDetail(created);
|
||||
}
|
||||
|
||||
async update(
|
||||
id: string,
|
||||
input: {
|
||||
name?: string;
|
||||
code?: string;
|
||||
status?: unknown;
|
||||
details?: readonly {
|
||||
privilegeKeyId: string;
|
||||
action: string;
|
||||
value: boolean;
|
||||
}[];
|
||||
userId: string;
|
||||
},
|
||||
): Promise<ReturnType<PrivilegesService['toDetail']>> {
|
||||
if (input.status !== undefined) {
|
||||
throw new BadRequestException('status cannot be updated via PATCH');
|
||||
}
|
||||
const payload: UpdatePrivilegeInput = {
|
||||
name: input.name?.trim(),
|
||||
code: input.code?.trim(),
|
||||
userId: input.userId,
|
||||
details:
|
||||
input.details !== undefined
|
||||
? await this.normalizeDetails(input.details)
|
||||
: undefined,
|
||||
};
|
||||
const updated = await this.privilegesRepository.update(id, payload);
|
||||
return this.toDetail(updated);
|
||||
}
|
||||
|
||||
async updateStatus(
|
||||
id: string,
|
||||
statusRaw: string,
|
||||
userId: string,
|
||||
): Promise<ReturnType<PrivilegesService['toListItem']>> {
|
||||
const status = Status.create(statusRaw);
|
||||
const updated = await this.privilegesRepository.updateStatus(
|
||||
id,
|
||||
status,
|
||||
userId,
|
||||
);
|
||||
return this.toListItem(updated);
|
||||
}
|
||||
|
||||
async bulkUpdateStatus(
|
||||
ids: string[],
|
||||
statusRaw: string,
|
||||
userId: string,
|
||||
): Promise<{ updated: number }> {
|
||||
const status = Status.create(statusRaw);
|
||||
const updated = await this.privilegesRepository.bulkUpdateStatus(
|
||||
ids,
|
||||
status,
|
||||
userId,
|
||||
);
|
||||
return { updated };
|
||||
}
|
||||
|
||||
async delete(id: string): Promise<void> {
|
||||
await this.privilegesRepository.delete(id);
|
||||
}
|
||||
|
||||
async bulkDelete(ids: string[]): Promise<{ deleted: number }> {
|
||||
const deleted = await this.privilegesRepository.bulkDelete(ids);
|
||||
return { deleted };
|
||||
}
|
||||
|
||||
async importCsv(csv: string, userId: string): Promise<{ imported: number }> {
|
||||
const lines = csv
|
||||
.split(/\r?\n/)
|
||||
.map((line) => line.trim())
|
||||
.filter((line) => line.length > 0);
|
||||
if (lines.length === 0) {
|
||||
throw new BadRequestException('CSV is empty');
|
||||
}
|
||||
if (lines.length > 501) {
|
||||
throw new BadRequestException('CSV exceeds maximum of 500 data rows');
|
||||
}
|
||||
|
||||
const header = lines[0].split(',').map((h) => h.trim().toLowerCase());
|
||||
const nameIdx = header.indexOf('name');
|
||||
const codeIdx = header.indexOf('code');
|
||||
const statusIdx = header.indexOf('status');
|
||||
if (nameIdx < 0 || codeIdx < 0) {
|
||||
throw new BadRequestException('CSV must include name and code headers');
|
||||
}
|
||||
|
||||
const errors: string[] = [];
|
||||
const rows: { name: string; code: string; status?: string }[] = [];
|
||||
for (let i = 1; i < lines.length; i++) {
|
||||
const cols = lines[i].split(',').map((c) => c.trim());
|
||||
const name = cols[nameIdx] ?? '';
|
||||
const code = cols[codeIdx] ?? '';
|
||||
const status = statusIdx >= 0 ? cols[statusIdx] : undefined;
|
||||
if (!name || !code) {
|
||||
errors.push(`row ${i + 1}: name and code are required`);
|
||||
continue;
|
||||
}
|
||||
if (name.length > 120 || code.length > 64) {
|
||||
errors.push(`row ${i + 1}: name or code too long`);
|
||||
continue;
|
||||
}
|
||||
if (status) {
|
||||
try {
|
||||
Status.create(status);
|
||||
} catch {
|
||||
errors.push(`row ${i + 1}: invalid status`);
|
||||
continue;
|
||||
}
|
||||
}
|
||||
rows.push({ name, code, status: status || undefined });
|
||||
}
|
||||
|
||||
if (errors.length > 0) {
|
||||
throw new BadRequestException({
|
||||
message: 'CSV validation failed',
|
||||
errors,
|
||||
});
|
||||
}
|
||||
|
||||
await this.privilegesRepository.createMany(
|
||||
rows.map((row) => ({
|
||||
name: row.name,
|
||||
code: row.code,
|
||||
status: row.status
|
||||
? Status.create(row.status)
|
||||
: Status.create(Status.DEFAULT),
|
||||
details: [],
|
||||
userId,
|
||||
})),
|
||||
);
|
||||
return { imported: rows.length };
|
||||
}
|
||||
|
||||
async listKeys(
|
||||
query: ListPrivilegeKeysQuery,
|
||||
): Promise<PaginationResponse<PrivilegeKey>> {
|
||||
const page = toListPage(query);
|
||||
return this.privilegesRepository.listKeys({
|
||||
search: query.search,
|
||||
limit: page.limit,
|
||||
offset: page.offset,
|
||||
});
|
||||
}
|
||||
|
||||
async checkPermission(
|
||||
userId: string,
|
||||
keyCode: string,
|
||||
action: PrivilegeAction,
|
||||
): Promise<boolean> {
|
||||
return this.privilegesRepository.checkPermission(userId, keyCode, action);
|
||||
}
|
||||
|
||||
async getPermissionsMap(
|
||||
privilegeId: string,
|
||||
): Promise<Record<string, Record<PrivilegeAction, boolean>>> {
|
||||
return this.privilegesRepository.getPermissionsMap(privilegeId);
|
||||
}
|
||||
|
||||
async findPrivilegeSummary(privilegeId: string): Promise<{
|
||||
id: string;
|
||||
name: string;
|
||||
code: string;
|
||||
status: string;
|
||||
} | null> {
|
||||
const privilege = await this.privilegesRepository.findById(privilegeId);
|
||||
if (!privilege) {
|
||||
return null;
|
||||
}
|
||||
return {
|
||||
id: privilege.id,
|
||||
name: privilege.name,
|
||||
code: privilege.code,
|
||||
status: privilege.status.value,
|
||||
};
|
||||
}
|
||||
|
||||
private async normalizeDetails(
|
||||
details?: readonly {
|
||||
privilegeKeyId: string;
|
||||
action: string;
|
||||
value: boolean;
|
||||
}[],
|
||||
): Promise<PrivilegeDetailInput[] | undefined> {
|
||||
if (details === undefined) {
|
||||
return undefined;
|
||||
}
|
||||
const normalized: PrivilegeDetailInput[] = [];
|
||||
for (const detail of details) {
|
||||
const key = await this.privilegesRepository.findKeyById(
|
||||
detail.privilegeKeyId,
|
||||
);
|
||||
if (!key) {
|
||||
throw new BadRequestException('Unknown privilege key');
|
||||
}
|
||||
normalized.push({
|
||||
privilegeKeyId: detail.privilegeKeyId,
|
||||
action: assertPrivilegeAction(detail.action),
|
||||
value: detail.value,
|
||||
});
|
||||
}
|
||||
return normalized;
|
||||
}
|
||||
|
||||
toListItem(privilege: Privilege) {
|
||||
return {
|
||||
id: privilege.id,
|
||||
name: privilege.name,
|
||||
code: privilege.code,
|
||||
status: privilege.status.value,
|
||||
createdAt: privilege.createdAt.value,
|
||||
updatedAt: privilege.updatedAt.value,
|
||||
createdBy: privilege.createdBy,
|
||||
updatedBy: privilege.updatedBy,
|
||||
};
|
||||
}
|
||||
|
||||
toDetail(privilege: PrivilegeWithDetails) {
|
||||
return {
|
||||
...this.toListItem(privilege),
|
||||
details: privilege.details.map((d) => ({
|
||||
id: d.id,
|
||||
privilegeKeyId: d.privilegeKeyId,
|
||||
keyCode: d.keyCode,
|
||||
keyLabel: d.keyLabel,
|
||||
sortOrder: d.sortOrder,
|
||||
action: d.action,
|
||||
value: d.value,
|
||||
})),
|
||||
};
|
||||
}
|
||||
|
||||
/** Expose whitelist for tests / documentation. */
|
||||
get visibleFields(): readonly string[] {
|
||||
return VISIBLE_FIELDS;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
import { ApiProperty } from '@nestjs/swagger';
|
||||
import { IsUUID, ValidateIf } from 'class-validator';
|
||||
|
||||
export class AssignPrivilegeDto {
|
||||
@ApiProperty({
|
||||
format: 'uuid',
|
||||
nullable: true,
|
||||
description: 'Privilege id to assign, or null to clear',
|
||||
})
|
||||
@ValidateIf((_, value) => value !== null)
|
||||
@IsUUID()
|
||||
privilegeId!: string | null;
|
||||
}
|
||||
|
||||
export class UserPrivilegeResponseDto {
|
||||
@ApiProperty({ format: 'uuid' })
|
||||
id!: string;
|
||||
|
||||
@ApiProperty()
|
||||
username!: string;
|
||||
|
||||
@ApiProperty({ format: 'uuid', nullable: true })
|
||||
privilegeId!: string | null;
|
||||
}
|
||||
@@ -4,6 +4,8 @@ export type User = {
|
||||
readonly id: string;
|
||||
readonly username: string;
|
||||
readonly passwordHash: string;
|
||||
readonly privilegeId: string | null;
|
||||
readonly isSuperadmin: boolean;
|
||||
readonly createdAt: DateTime;
|
||||
readonly updatedAt: DateTime;
|
||||
};
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
import { Body, Controller, Param, ParseUUIDPipe, Patch } from '@nestjs/common';
|
||||
import {
|
||||
ApiBearerAuth,
|
||||
ApiForbiddenResponse,
|
||||
ApiNotFoundResponse,
|
||||
ApiOkResponse,
|
||||
ApiOperation,
|
||||
ApiTags,
|
||||
ApiUnauthorizedResponse,
|
||||
} from '@nestjs/swagger';
|
||||
import { RequirePrivilege } from '../../common/decorators/require-privilege.decorator';
|
||||
import { BEARER_AUTH_NAME } from '../../common/swagger/setup-swagger';
|
||||
import {
|
||||
AssignPrivilegeDto,
|
||||
UserPrivilegeResponseDto,
|
||||
} from './dto/assign-privilege.dto';
|
||||
import { UsersService } from './users.service';
|
||||
|
||||
@ApiTags('users')
|
||||
@ApiBearerAuth(BEARER_AUTH_NAME)
|
||||
@Controller('users')
|
||||
export class UsersController {
|
||||
constructor(private readonly usersService: UsersService) {}
|
||||
|
||||
@Patch(':id/privilege')
|
||||
@RequirePrivilege('USERS', 'update')
|
||||
@ApiOperation({ summary: 'Assign or clear a user privilege' })
|
||||
@ApiOkResponse({ type: UserPrivilegeResponseDto })
|
||||
@ApiNotFoundResponse()
|
||||
@ApiUnauthorizedResponse()
|
||||
@ApiForbiddenResponse()
|
||||
async assignPrivilege(
|
||||
@Param('id', ParseUUIDPipe) id: string,
|
||||
@Body() dto: AssignPrivilegeDto,
|
||||
): Promise<UserPrivilegeResponseDto> {
|
||||
const user = await this.usersService.assignPrivilege(id, dto.privilegeId);
|
||||
return {
|
||||
id: user.id,
|
||||
username: user.username,
|
||||
privilegeId: user.privilegeId,
|
||||
};
|
||||
}
|
||||
}
|
||||
@@ -1,8 +1,12 @@
|
||||
import { Module } from '@nestjs/common';
|
||||
import { PrivilegesModule } from '../privileges/privileges.module';
|
||||
import { UsersController } from './users.controller';
|
||||
import { UsersRepository } from './users.repository';
|
||||
import { UsersService } from './users.service';
|
||||
|
||||
@Module({
|
||||
imports: [PrivilegesModule],
|
||||
controllers: [UsersController],
|
||||
providers: [UsersRepository, UsersService],
|
||||
exports: [UsersService],
|
||||
})
|
||||
|
||||
@@ -29,13 +29,20 @@ describe('UsersRepository', () => {
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
passwordHash: 'hash',
|
||||
privilegeId: null,
|
||||
isSuperadmin: false,
|
||||
createdAt: 1_700_000_000_000,
|
||||
updatedAt: 1_700_000_000_000,
|
||||
},
|
||||
]);
|
||||
|
||||
const user = await repository.findById('user-1');
|
||||
expect(user).toMatchObject({ id: 'user-1', username: 'alice' });
|
||||
expect(user).toMatchObject({
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
privilegeId: null,
|
||||
isSuperadmin: false,
|
||||
});
|
||||
expect(user?.createdAt.value).toBe(1_700_000_000_000);
|
||||
});
|
||||
|
||||
@@ -50,6 +57,8 @@ describe('UsersRepository', () => {
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
passwordHash: 'hash',
|
||||
privilegeId: null,
|
||||
isSuperadmin: false,
|
||||
createdAt: 1_700_000_000_000,
|
||||
updatedAt: 1_700_000_000_000,
|
||||
},
|
||||
@@ -60,6 +69,7 @@ describe('UsersRepository', () => {
|
||||
passwordHash: 'hash',
|
||||
});
|
||||
expect(user.username).toBe('alice');
|
||||
expect(user.privilegeId).toBeNull();
|
||||
expect(values).toHaveBeenCalledWith(
|
||||
expect.objectContaining({ username: 'alice', passwordHash: 'hash' }),
|
||||
);
|
||||
@@ -71,6 +81,8 @@ describe('UsersRepository', () => {
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
passwordHash: 'hash',
|
||||
privilegeId: null,
|
||||
isSuperadmin: false,
|
||||
createdAt: 1_700_000_000_000,
|
||||
updatedAt: 1_700_000_000_000,
|
||||
},
|
||||
|
||||
@@ -1,4 +1,9 @@
|
||||
import { ConflictException, Inject, Injectable } from '@nestjs/common';
|
||||
import {
|
||||
ConflictException,
|
||||
Inject,
|
||||
Injectable,
|
||||
NotFoundException,
|
||||
} from '@nestjs/common';
|
||||
import { eq } from 'drizzle-orm';
|
||||
import { users, type UserRow } from '../../database/schema';
|
||||
import { DateTime } from '../../common/value-objects/date-time/date-time';
|
||||
@@ -49,11 +54,32 @@ export class UsersRepository {
|
||||
}
|
||||
}
|
||||
|
||||
async updatePrivilegeId(
|
||||
userId: string,
|
||||
privilegeId: string | null,
|
||||
): Promise<User> {
|
||||
const now = DateTime.fromUnixMs(Date.now());
|
||||
const [row] = await this.db
|
||||
.update(users)
|
||||
.set({
|
||||
privilegeId,
|
||||
updatedAt: now.value,
|
||||
})
|
||||
.where(eq(users.id, userId))
|
||||
.returning();
|
||||
if (!row) {
|
||||
throw new NotFoundException('User not found');
|
||||
}
|
||||
return this.toDomain(row);
|
||||
}
|
||||
|
||||
private toDomain(row: UserRow): User {
|
||||
return {
|
||||
id: row.id,
|
||||
username: row.username,
|
||||
passwordHash: row.passwordHash,
|
||||
privilegeId: row.privilegeId ?? null,
|
||||
isSuperadmin: row.isSuperadmin,
|
||||
createdAt: DateTime.fromUnixMs(row.createdAt),
|
||||
updatedAt: DateTime.fromUnixMs(row.updatedAt),
|
||||
};
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
import { ConflictException } from '@nestjs/common';
|
||||
import { Test, TestingModule } from '@nestjs/testing';
|
||||
import { DateTime } from '../../common/value-objects/date-time/date-time';
|
||||
import { PrivilegesService } from '../privileges/privileges.service';
|
||||
import type { User } from './user';
|
||||
import { UsersRepository } from './users.repository';
|
||||
import { UsersService } from './users.service';
|
||||
@@ -8,7 +9,13 @@ import { UsersService } from './users.service';
|
||||
describe('UsersService', () => {
|
||||
let service: UsersService;
|
||||
let repository: jest.Mocked<
|
||||
Pick<UsersRepository, 'findById' | 'findByUsername' | 'create'>
|
||||
Pick<
|
||||
UsersRepository,
|
||||
'findById' | 'findByUsername' | 'create' | 'updatePrivilegeId'
|
||||
>
|
||||
>;
|
||||
let privilegesService: jest.Mocked<
|
||||
Pick<PrivilegesService, 'findPrivilegeSummary'>
|
||||
>;
|
||||
|
||||
const now = DateTime.fromUnixMs(1_700_000_000_000);
|
||||
@@ -16,6 +23,8 @@ describe('UsersService', () => {
|
||||
id: 'user-1',
|
||||
username: 'alice',
|
||||
passwordHash: 'hashed',
|
||||
privilegeId: null,
|
||||
isSuperadmin: false,
|
||||
createdAt: now,
|
||||
updatedAt: now,
|
||||
};
|
||||
@@ -25,12 +34,17 @@ describe('UsersService', () => {
|
||||
findById: jest.fn(),
|
||||
findByUsername: jest.fn(),
|
||||
create: jest.fn(),
|
||||
updatePrivilegeId: jest.fn(),
|
||||
};
|
||||
privilegesService = {
|
||||
findPrivilegeSummary: jest.fn(),
|
||||
};
|
||||
|
||||
const moduleRef: TestingModule = await Test.createTestingModule({
|
||||
providers: [
|
||||
UsersService,
|
||||
{ provide: UsersRepository, useValue: repository },
|
||||
{ provide: PrivilegesService, useValue: privilegesService },
|
||||
],
|
||||
}).compile();
|
||||
|
||||
@@ -68,4 +82,21 @@ describe('UsersService', () => {
|
||||
repository.findByUsername.mockResolvedValue(sampleUser);
|
||||
await expect(service.findByUsername('Alice')).resolves.toEqual(sampleUser);
|
||||
});
|
||||
|
||||
it('assignPrivilege validates privilege exists', async () => {
|
||||
repository.findById.mockResolvedValue(sampleUser);
|
||||
privilegesService.findPrivilegeSummary.mockResolvedValue({
|
||||
id: 'priv-1',
|
||||
name: 'Admin',
|
||||
code: 'ADMIN',
|
||||
status: 'active',
|
||||
});
|
||||
repository.updatePrivilegeId.mockResolvedValue({
|
||||
...sampleUser,
|
||||
privilegeId: 'priv-1',
|
||||
});
|
||||
|
||||
const result = await service.assignPrivilege('user-1', 'priv-1');
|
||||
expect(result.privilegeId).toBe('priv-1');
|
||||
});
|
||||
});
|
||||
|
||||
@@ -1,10 +1,19 @@
|
||||
import { ConflictException, Injectable } from '@nestjs/common';
|
||||
import {
|
||||
BadRequestException,
|
||||
ConflictException,
|
||||
Injectable,
|
||||
NotFoundException,
|
||||
} from '@nestjs/common';
|
||||
import { PrivilegesService } from '../privileges/privileges.service';
|
||||
import { UsersRepository } from './users.repository';
|
||||
import type { User } from './user';
|
||||
|
||||
@Injectable()
|
||||
export class UsersService {
|
||||
constructor(private readonly usersRepository: UsersRepository) {}
|
||||
constructor(
|
||||
private readonly usersRepository: UsersRepository,
|
||||
private readonly privilegesService: PrivilegesService,
|
||||
) {}
|
||||
|
||||
async findById(id: string): Promise<User | null> {
|
||||
return this.usersRepository.findById(id);
|
||||
@@ -25,4 +34,25 @@ export class UsersService {
|
||||
passwordHash,
|
||||
});
|
||||
}
|
||||
|
||||
async assignPrivilege(
|
||||
userId: string,
|
||||
privilegeId: string | null,
|
||||
): Promise<User> {
|
||||
const user = await this.usersRepository.findById(userId);
|
||||
if (!user) {
|
||||
throw new NotFoundException('User not found');
|
||||
}
|
||||
if (privilegeId !== null) {
|
||||
const privilege =
|
||||
await this.privilegesService.findPrivilegeSummary(privilegeId);
|
||||
if (!privilege) {
|
||||
throw new NotFoundException('Privilege not found');
|
||||
}
|
||||
if (privilege.status !== 'active') {
|
||||
throw new BadRequestException('Privilege must be active');
|
||||
}
|
||||
}
|
||||
return this.usersRepository.updatePrivilegeId(userId, privilegeId);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user